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The GSMA represents the interests of mobile operators worldwide, uniting nearly 800 operators with more than 
250 companies in the broader mobile ecosystem, including handset and device makers, software companies, 
equipment providers and Internet companies, as well as organisations in adjacent industry sectors. The GSMA 
also produces industry-leading events such as Mobile World Congress, Mobile World Congress Shanghai and 
the Mobile 360 Series conferences. 


For more information, please visit the GSMA corporate website at www.qsma.com 


GSMA Response: ICO Call for Evidence on the Age Appropriate Design Code 


The GSMA would like to thank the Information Commissioner for the opportunity to provide 
evidence in response to the consultation on the Age Appropriate Design Code. We welcome 
the opportunity to work with other stakeholders to shape this code as it develops. 


Mobile Industry Commitment to Protecting Children 


The GSMA and its members are committed to enabling young people to access 
opportunities through mobile safely and responsibly, while actively combatting the misuse of 
mobile technology to exploit children. We recognise that the UN Convention on the Rights of 
the Child (UN CRC) sets out the specific rights that all children, everywhere, are entitled to in 
order to survive and thrive, to learn and grow, and to reach their full potential. Mobile 
technology is a great enabler of many children’s rights. For growing numbers of young 
people, it is an increasingly important tool for communicating, seeking help or protection, 
accessing information and entertainment, as well as learning and being creative. These 
opportunities must be promoted, while also protecting children. 


The GSMA and mobile industry work with stakeholders from the international community, 
governments, NGOs and law enforcement to protect and promote children’s rights in today’s 
digital world. In particular, through our GSMA mYouth Programme, we collaborate with 
stakeholders from across the mobile ecosystem, as well as NGOs and government 
organisations, to help young people make the most of their mobile experience. 


The GSMA and its member operators have a long history of commitment to the safe and 
responsible use of mobile by children. For example, over ten years ago the GSMA 
developed a self-regulatory initiative- the European Framework for Safer Mobile Use by 
Younger Teenagers and Children- to ensure that children can safely access content on their 
phones.‘ More recently, we produced guidelines with Child Helpline International and a 
range of expert partners on internet safety for helpline counsellors/volunteers.? One set of 
these guidelines specifically addresses how to support children (and their parents) who have 
concerns relating to privacy.’ 


Additionally, the GSMA has taken steps with other relevant stakeholders to combat the 
misuse of mobile services to access, share, etc., child sexual abuse material. The GSMA’s 
Mobile Alliance Against Child Sexual Abuse Content (Mobile Alliance) was founded in 2008 
by an international group of mobile operators within the GSMA to obstruct the use of the 
mobile environment by individuals or organisations wishing to consume or profit from child 
sexual abuse content. One way we have addressed this issue is to assert the right to privacy 
of the child in the images and/or video. Our engagement in this area has led to our work with 
INHOPE* on responding to reports of illegal online content and with UNICEF in the context 


1 European Framework for Safer Mobile Use by Younger Teenagers and Children, available at: 
https ://www.gsma.com/iot/wp-content/uploads/2012/03/Safer Mobile Flyer.pdf 

2 Internet Safety Guides, available at: https:/(www.gsma.com/publicpolicy/internet-safety-quides 
3 Internet Safety Guide on Privacy, available at: https:/Awww.gsma.com/publicpolicy/wp- 
content/uploads/2017/03/Privacy GSMA-CHI_ V1.pdf 

4 Hotlines: Responding to reports of illegal online content, available at: 

https ://www.gsma.com/publicpolicy/wp- 
content/uploads/2012/03/GSMA_Inhopebrochure2016_Web.pdf 
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of notice and take down mechanisms?. Our collaboration with these organisations and others 
serves as an example of the GSMA Mobile Alliance ‘leaning in' to the problem of misuse of 
mobile services and working to support the wider ecosystem. 


Guidelines for Industry on Child Online Protection - GSMA, UNICEF, International 
Telecommunication Union 


We recognise the unique privacy challenges facing our youngest users. To address these 
challenges, we collaborated with UNICEF and the International Telecommunication Union to 
develop the Guidelines for Industry on Child Online Protection (COP), which include specific 
privacy considerations, and a related checklist for Mobile Operators.® 


COP Checklist for Mobile Operators: 


Mobile operators can identify, prevent and mitigate the adverse impacts of 
information and communications technologies (ICTs) on children’s rights, and identify 
opportunities to support the advancement of children’s rights. 


Ensure that a specific individual and/or a team is designated with 
responsibility for this process and has access to the necessary internal and 
external stakeholders. Provide this person/team with the authority to take the 
lead in raising the profile of child online protection across the company. 
Develop a child protection / safeguarding policy and/or integrate specific 
children’s rights risks and opportunities into companywide policy 
commitments (e.g., human rights, privacy, marketing and relevant codes of 
conduct). 

Integrate due diligence on child online protection issues into existing human 
rights or risk assessment frameworks (e.g., at the corporate level, product or 
technology level, and/or at the country level) to determine whether the 
business may be causing or contributing to adverse impacts through its own 
activities, or whether adverse impacts may be directly linked to its operations, 
products or services or business relationships. 

Identify child rights impacts on different age groups as a result of company 
operations and the design, development and introduction of products and 
services — as well as opportunities to support children’s rights. 

Draw upon internal and external expertise and consult with key stakeholders, 
including children, on child online safety mechanisms to obtain ongoing 
feedback and guidance on company approaches. 

In States which lack adequate legal frameworks for the protection of 
children’s rights to privacy and freedom of expression, companies should 
ensure policies and practices are in line with international standards. (UN 
General Assembly Resolution, “The right to privacy in the digital age”, 
A/RES/68/167) 


5 NOTICE AND TAKEDOWN Company policies and practices to remove online child sexual abuse 


material, available at: https:/Avwww.gqsma.com/publicpolicy/wp- 
content/uploads/2012/03/notice and takedown gsma_ unicef april 2016.pdf 
§ Child Online Protection Guidelines, available at: https:/Avwww.gsma.com/publicpolicy/wp- 


content/uploads/2016/10//TU UNICEF 2014 Mobile Operators COP Guidelines.pdf 
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e Ensure access to remedy by putting in place operational-level grievance and 
reporting mechanisms for any child rights violations (e.g., child sexual abuse 
material, inappropriate content or contact, breaches of privacy). 


2018 UNICEF Industry Toolkit on Children’s Online Privacy and Freedom of 
Expression 


The GSMA also contributed to the UNICEF 2018 /ndustry Toolkit on Children’s Online 
Privacy and Freedom of Expression. The Toolkit is divided into two distinct sections: 


1. General Principles on Children’s Online Privacy and Freedom of Expression. These 
five rights-based general principles set out the shared responsibility of governments, 
businesses, parents, educators and children to protect, respect and realize children’s 
privacy and expression rights in a digital world. 


2. Checklist for Companies. This checklist provides a list of questions for companies to 
assess their policies and practices with regard to obtaining, using and retaining 
children’s personal data; ensuring children’s access to information; and educating 
and informing children online. The checklist includes questions for 
telecommunications and internet service providers, including: 


How does your company know when a user is a child? Context: Although 
communications service providers may not directly engage with children as 
customers, many users of these services are children. Respecting children’s rights 
may require understanding which users are children to afford them specific 
protection. 


What steps does your company take to protect the personal data of children 
who use your services? Context: When children’s personal data are processed, 
whether children are customers or users, they should be informed of how their 
personal data are being used and for what purposes. Similarly, adult customers 
should be educated and empowered to protect the personal data of child users. 


GSMA Mobile Privacy Principles 


The GSMA Mobile Privacy Principles describe the way in which mobile consumers’ privacy 
should be respected and protected when consumers use mobile applications and services 
that access, collect and use personal information. These principles reflect the mobile 
industry’s commitment to privacy and trust. The GSMA Mobile Privacy Principles are similar 
to many other global privacy principles, with a notable exception- the special emphasis on 
children and adolescents. 


GSMA Mobile Privacy Principle on Children and Adolescents: An application or 

service that is directed at children and adolescents should ensure that the collection, 
access and use of personal information is appropriate in all given circumstances and 
compatible with national law. 
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Aspects of Design: GSMA Approach to Privacy by Design 


The GSMA advocates for the integration of privacy into the design process, and in 
collaboration with representatives from the mobile ecosystem, the GSMA has developed the 
Privacy Design Guidelines for Mobile Application Development.’ They seek to articulate the 
GSMA Mobile Privacy Principles in more functional terms and are intended to help drive a 
more consistent approach to user privacy across mobile platforms, applications and devices. 
The guidelines are focused on putting mobile users first, helping them to manage their 
information and their privacy on mobile phones in clear and simple ways. Implementing the 
guidelines should help mitigate risks that could impact users, including children. The 
guidelines also include considerations directly related to children’s use of mobile apps, for 


example®: 


Tailor applications 
to appropriate age 
ranges. 


Applications that are 
intended for children 
and adolescents 
should be 
appropriate for the 
target age range 
and help such users 
to easily understand 
the consequences of 
installing or using an 
application or 
service. 


Set privacy 
protective default 
settings. 


Applications that are 
intended for children 
and adolescents 
must have a location 
default setting that 
prevents users from 
automatically 
publishing their 
precise location 
data. 


Comply with laws 
on the protection 
of children. 


Applications must at 
all times comply with 
the special legal 
requirements that 
applicable 
jurisdictions may 
impose to protect 
children. 


Age verify where 
possible and 
appropriate. 


Under certain 
circumstances, age 
verification may be 
appropriate (for 
example, where 
applications contain 
social networking 
features or allow 
access to adult 
content). 


The GSMA and its members continue to work to support children’s rights online. We are 
available to answer any specific questions from the Information Commissioner regarding our 
position on age appropriate design. 


7 GSMA Privacy Design Guidelines for Mobile Application Development, available at: 

https ://www.gsma.com/publicpolicy/wp-content/uploads/2018/02/GSMA-Privacy-Design-Guidelines- 
for-Mobile-Application-Development.pdf 

8 Pages 18-19 of the GSMA Privacy Design Guidelines for Mobile Application Development also 
include advice for implementing these guidelines, use cases, and examples. 
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